Core concept
Public subnet: route to IGW → internet. Private subnet: route through NAT for outbound. Isolated: no internet.
Advertisement
How it works
One VPC per region. Cross-VPC via peering, Transit Gateway, or PrivateLink. Cross-region via TGW peering.
Advertisement
Trade-offs + gotchas
Every AWS account. Multi-tier apps (public LB, private app, isolated DB subnets). Compliance isolation.